.

pkg/antivm/antivm.go

@@ -0,0 +1,35 @@
+package antivm
+
+func Check() bool {
+	if checkDMI() {
+		return true
+	}
+	if checkMAC() {
+		return true
+	}
+	if checkCPUID() {
+		return true
+	}
+	if checkDisk() {
+		return true
+	}
+	if checkPCI() {
+		return true
+	}
+	if checkTiming() {
+		return true
+	}
+	if checkSystemProfiler() {
+		return true
+	}
+	if checkIOKit() {
+		return true
+	}
+	if checkRegistry() {
+		return true
+	}
+	if checkWMI() {
+		return true
+	}
+	return false
+}

pkg/antivm/antivm_darwin.go

@@ -0,0 +1,98 @@
+//go:build darwin
+
+package antivm
+
+import (
+	"net"
+	"os/exec"
+	"strings"
+)
+
+var vmIdentifiers = []string{
+	"VMware",
+	"VirtualBox",
+	"QEMU",
+	"KVM",
+	"Xen",
+	"Microsoft Corporation",
+	"Parallels",
+}
+
+var vmMACPrefixes = []string{
+	"00:0c:29",
+	"08:00:27",
+	"52:54:00",
+	"00:1c:42",
+}
+
+func containsAny(s string, needles []string) bool {
+	for _, n := range needles {
+		if strings.Contains(s, n) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkMAC() bool {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return false
+	}
+	for _, iface := range ifaces {
+		mac := strings.ToLower(iface.HardwareAddr.String())
+		if mac == "" {
+			continue
+		}
+		for _, prefix := range vmMACPrefixes {
+			if strings.HasPrefix(mac, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkSystemProfiler() bool {
+	out, err := exec.Command("system_profiler", "SPHardwareDataType").Output()
+	if err != nil {
+		return false
+	}
+	return containsAny(string(out), vmIdentifiers)
+}
+
+func checkIOKit() bool {
+	out, err := exec.Command("ioreg", "-l").Output()
+	if err != nil {
+		return false
+	}
+	return containsAny(string(out), vmIdentifiers)
+}
+
+func checkDMI() bool {
+	return false
+}
+
+func checkCPUID() bool {
+	return false
+}
+
+func checkDisk() bool {
+	return false
+}
+
+func checkPCI() bool {
+	return false
+}
+
+func checkTiming() bool {
+	return false
+}
+
+func checkRegistry() bool {
+	return false
+}
+
+func checkWMI() bool {
+	return false
+}

pkg/antivm/antivm_linux.go

@@ -0,0 +1,161 @@
+//go:build linux
+
+package antivm
+
+import (
+	"net"
+	"os"
+	"strings"
+	"time"
+)
+
+var vmIdentifiers = []string{
+	"VMware",
+	"VirtualBox",
+	"QEMU",
+	"KVM",
+	"Xen",
+	"Microsoft Corporation",
+	"Parallels",
+}
+
+var vmMACPrefixes = []string{
+	"00:0c:29",
+	"08:00:27",
+	"52:54:00",
+	"00:1c:42",
+}
+
+var vmPCIVendors = []string{
+	"15ad",
+	"80ee",
+	"1234",
+}
+
+func readSysfsTrimmed(path string) string {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
+func containsAny(s string, needles []string) bool {
+	for _, n := range needles {
+		if strings.Contains(s, n) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkDMI() bool {
+	paths := []string{
+		"/sys/class/dmi/id/sys_vendor",
+		"/sys/class/dmi/id/product_name",
+	}
+	for _, p := range paths {
+		val := readSysfsTrimmed(p)
+		if containsAny(val, vmIdentifiers) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkMAC() bool {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return false
+	}
+	for _, iface := range ifaces {
+		mac := strings.ToLower(iface.HardwareAddr.String())
+		if mac == "" {
+			continue
+		}
+		for _, prefix := range vmMACPrefixes {
+			if strings.HasPrefix(mac, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkCPUID() bool {
+	data, err := os.ReadFile("/proc/cpuinfo")
+	if err != nil {
+		return false
+	}
+	content := string(data)
+
+	if strings.Contains(content, "hypervisor") {
+		return true
+	}
+
+	if strings.Contains(content, "QEMU Virtual CPU") {
+		return true
+	}
+
+	return false
+}
+
+func checkDisk() bool {
+	entries, err := os.ReadDir("/sys/block")
+	if err != nil {
+		return false
+	}
+	for _, entry := range entries {
+		modelPath := "/sys/block/" + entry.Name() + "/device/model"
+		model := readSysfsTrimmed(modelPath)
+		if containsAny(model, vmIdentifiers) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkPCI() bool {
+	entries, err := os.ReadDir("/sys/bus/pci/devices")
+	if err != nil {
+		return false
+	}
+	for _, entry := range entries {
+		vendorPath := "/sys/bus/pci/devices/" + entry.Name() + "/vendor"
+		vendor := readSysfsTrimmed(vendorPath)
+		vendorID := strings.TrimPrefix(vendor, "0x")
+		for _, v := range vmPCIVendors {
+			if vendorID == v {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkTiming() bool {
+	start := time.Now()
+	sum := 0
+	for i := 0; i < 100000; i++ {
+		sum += i
+	}
+	elapsed := time.Since(start)
+	_ = sum
+	return elapsed > 10*time.Millisecond
+}
+
+func checkSystemProfiler() bool {
+	return false
+}
+
+func checkIOKit() bool {
+	return false
+}
+
+func checkRegistry() bool {
+	return false
+}
+
+func checkWMI() bool {
+	return false
+}

pkg/antivm/antivm_windows.go

@@ -0,0 +1,130 @@
+//go:build windows
+
+package antivm
+
+import (
+	"net"
+	"os/exec"
+	"strings"
+	"syscall"
+	"unsafe"
+)
+
+var vmIdentifiers = []string{
+	"VMware",
+	"VirtualBox",
+	"QEMU",
+	"KVM",
+	"Xen",
+	"Microsoft Corporation",
+	"Parallels",
+	"VBOX",
+	"Virtual HD",
+}
+
+var vmMACPrefixes = []string{
+	"00:0c:29",
+	"08:00:27",
+	"52:54:00",
+	"00:1c:42",
+}
+
+func containsAny(s string, needles []string) bool {
+	for _, n := range needles {
+		if strings.Contains(s, n) {
+			return true
+		}
+	}
+	return false
+}
+
+func checkMAC() bool {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return false
+	}
+	for _, iface := range ifaces {
+		mac := strings.ToLower(iface.HardwareAddr.String())
+		if mac == "" {
+			continue
+		}
+		for _, prefix := range vmMACPrefixes {
+			if strings.HasPrefix(mac, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func checkRegistry() bool {
+	var h syscall.Handle
+	keyPath, _ := syscall.UTF16PtrFromString(`SYSTEM\CurrentControlSet\Services\Disk\Enum`)
+	err := syscall.RegOpenKeyEx(
+		syscall.HKEY_LOCAL_MACHINE,
+		keyPath,
+		0,
+		syscall.KEY_READ,
+		&h,
+	)
+	if err != nil {
+		return false
+	}
+	defer syscall.RegCloseKey(h)
+
+	var buf [512]uint16
+	var bufLen uint32 = uint32(len(buf) * 2)
+	var valType uint32
+
+	name, _ := syscall.UTF16PtrFromString("0")
+	err = syscall.RegQueryValueEx(
+		h,
+		name,
+		nil,
+		&valType,
+		(*byte)(unsafe.Pointer(&buf[0])),
+		&bufLen,
+	)
+	if err != nil {
+		return false
+	}
+
+	val := syscall.UTF16ToString(buf[:])
+	return containsAny(val, vmIdentifiers)
+}
+
+func checkWMI() bool {
+	out, err := exec.Command("wmic", "computersystem", "get", "model").Output()
+	if err != nil {
+		return false
+	}
+	return containsAny(string(out), vmIdentifiers)
+}
+
+func checkDMI() bool {
+	return false
+}
+
+func checkCPUID() bool {
+	return false
+}
+
+func checkDisk() bool {
+	return false
+}
+
+func checkPCI() bool {
+	return false
+}
+
+func checkTiming() bool {
+	return false
+}
+
+func checkSystemProfiler() bool {
+	return false
+}
+
+func checkIOKit() bool {
+	return false
+}